[itemsep=4pt]
Poisoning attack [1]}: The server, in addition to the users' data, trains the model with data \((x^*, y_t)\)  for target user \(u_t\) . At test time, the model outputs \(y_t\)  when queried with \(x^*\)  and thus wrongly authenticates \(x^*\)  as a true sample from user \(u_t\) .

Evasion attack [2]}, [3]}: Attacks based on adversarial examples are known to be highly effective against deep neural networks [4]}. In the context of UA models, when a target embedding vector is known, an evasion attack can be performed to slightly perturb any given input such that the predicted embedding matches a target embedding and thus is accepted by the model.

